Which feature filters the IPv6 traffic on Layer 2 untrusted ports?
IPv6 Source Guard is the first-hop-security feature that filters IPv6 traffic on Layer 2 untrusted ports, blocking any data packet whose source address/link-layer pairing is not already present in the IPv6 binding table (populated via ND inspection or DHCP snooping). RA Guard and DHCPv6 Guard, by contrast, filter only specific control-plane message types (router advertisements or DHCP server messages), not general data traffic.
Community Discussion